Information clause

INFORMATION ON THE PROCESSING OF PERSONAL DATA BY MEDICOVER SP. Z O.O.

1. Personal data controller

The data controller for your personal data is Medi Partner sp. z o.o., 36 Rakowiecka Street, 02-532 Warsaw (hereinafter: ‘we’). You can contact us as follows:

• by post to the following address: Medi Partner sp. z o.o., 36 Rakowiecka Street, 02-532 Warsaw
• via the contact form available on the invimed.pl website
• za pośrednictwem Infolinii pod numerem 500 900 888

2. Data Protection Officer

We have appointed a Data Protection Officer, whom you may contact regarding any matters relating to the processing of personal data by post at the address given in point 1, marked ‘Data Protection Officer’, or by email: IOD@medipartner.pl.

3. the purposes of processing your personal data and the legal basis for the processing

PURPOSES AND LEGAL BASES FOR THE PROCESSING OF YOUR PERSONAL DATA
granting health services, in particular in the areas of preventive healthcare, diagnosis, treatment and the management of the treatment process; maintaining, archiving and making available medical records in accordance with the applicable legislation   verifying the patient’s identity before providing a service, processing a request or disclosing information, in order to ensure the patient is correctly identified and that medical data is protected organisation, implementation and documentation telemedicine services, including teleconsultations   patient care, including registration and booking appointments, as well as communicating with patients concerning preventive healthcare, educational activities and how to access services	– Article 6(1)(c) of the GDPR, in conjunction with the provisions of the Act on Patients’ Rights and the Patients’ Rights Ombudsman, and other legislation governing healthcare activities, – Article 9(2)(h) of the GDPR, – Article 9(3) of the GDPR
the provision of services funded from public funds, under a contract with the National Health Fund, and carrying out reporting and accounting duties	– Article 6(1)(c) of the GDPR – Article 9(2)(h) of the GDPR
the provision of paid services, paid for directly by the patient, including the arrangement and provision of contracts for the storage and/or transport of gametes and embryos	– Article 6(1)(b) of the GDPR – Article 9(2)(h) of the GDPR
carrying out settlements in connection with its business activities, including the issuance, transmission and archiving of structured invoices in the National e-Invoice System (hereinafter „KSeF”), and the maintenance of accounting and implementation tax obligations	– Article 6(1)(c) of the GDPR
service enquiries, complaints or conclusions patients identifying, investigating or defence against claims	– Article 6(1)(f) of the GDPR – Article 9(2)(f) of the GDPR. Our legitimate interest is to handle patient enquiries, ensure the quality of the services we provide, and to establish, pursue or defend against claims.
ensuring the safety of people and property by carrying out CCTV on the premises of the company’s medical centres, offices and other facilities	– Article 6(1)(f) of the GDPR It is in our legitimate interests to ensure the safety of our patients and staff, and to protect our property.
assessment the quality of the services provided, improving standards of care, the organisation of healthcare facilities and the patient experience	– Article 6(1)(f) of the GDPR It is in our legitimate interest to improve the quality of the services we provide
management marketing activities, including the sending of newsletters, commercial information and promotional communications	– Article 6(1)(a) or (f) of the GDPR – consent required under telecommunications legislation or legislation governing electronic communications
management scientific research and research and development projects aimed at advancing medical knowledge and improving the quality of healthcare	– Article 6(1)(e) of the GDPR   – Article 9(2)(j) of the GDPR, where such research is expressly provided for by law If the law requires the patient’s consent, the data will be processed on the basis of consent given separately (Article 9(2)(a) of the GDPR)
carrying out analyses business, statistical, organisational and quality-related aspects, as well as the improvement of medical and non-medical processes	– Article 6(1)(f) of the GDPR   – Article 9(2)(h) of the GDPR – where the processing is related to the management of healthcare systems and services It is in our legitimate interest to improve the quality, accessibility and organisation of the healthcare services we provide

4. Data source

 In most cases, we will obtain your personal data directly from you. However, there may be occasions when we obtain your data from:

• an organisation funding healthcare services
• an insurance company or healthcare providers
• other healthcare providers involved in the treatment process
• members of your family, legal representatives or persons authorised to act on your behalf
• the National Health Fund (NFZ) or other authorised public bodies

Depending on the source, the data may include identification details, contact details, details relating to employment or entitlement to benefits, billing details, and health-related data necessary for the provision of healthcare services or to fulfil legal obligations.

5 Information on profiling

We may use your personal data for profiling, which involves the automated assessment of certain personal factors relating to you. Below, we set out the situations in which profiling may take place.

We carry out profiling to:

• respectively select communication and promotional materials prowadzoną przez nas działalność – w tym celu wykorzystujemy takie dane jak: numer pacjenta, imię, nazwisko, wiek, płeć, język, data urodzenia, miejscowość, odwiedzane placówki, rodzaj wykupionego produktu, źródło pozyskania danych. Ponadto możemy brać pod uwagę także dane statystyczne dotyczące zachowania na stronach www, korzystania z Portalu Pacjenta Invimed oraz preferencje wyrażone w serwisach Medi Partner;
• ensure top-quality services – including through the use of new technologies, IT, analytical or algorithmic solutions that support the organisation of services, patient care, data security and the streamlining of processes, whilst applying appropriate safeguards and respecting patients’ rights. In certain situations, we will process your personal data relating to the provision of services using an algorithm to assist the staff providing your care. The algorithm does not make decisions about your treatment on its own – the decision is always made by the person providing the service. If you believe that the algorithm may have misjudged your situation, you may exercise your right to be assessed solely by a human and ask us to explain how the algorithm works.

6 Period of retention of your personal data

We will process your data as a general rule:

• for 90 years – in connection with the maintenance and archiving of medical records relating to infertility treatment, from the time such records were first kept
• 20 lat – w związku z prowadzeniem i przechowywaniem dokumentacji medycznej ze świadczonych usług poza zakresem leczenia niepłodności;
• przez 6 lat – w związku z dochodzeniem i obroną przed roszczeniami w związku ze zrealizowanymi usługami;
• for 5 years – for accounting and tax purposes;
• up to 2 years – in connection with the recording of calls on our helpline;
• up to 90 days – in connection with the CCTV monitoring carried out;
• until you object or withdraw your consent to the processing of your personal data, if we processed your data on such a basis.

7 Recipients of your personal data

We will transfer your personal data:

• podmiotom uprawnionym przepisami prawa, w szczególności:
  • podmiotom leczniczym w celu zapewnienia ciągłości leczenia oraz dostępności opieki zdrowotnej,
  • insurance companies,
  • public authorities authorised to obtain your data,
  • NFZ i MZ, w ramach realizowania świadczeń ze środków publicznych;
• entities authorised by you;
• podmiotom przetwarzającym dane w naszym imieniu i zgodnie z naszymi poleceniami, którym zlecamy realizację usług z zakresu m.in. IT i marketingu;
• podmiotom, które świadczą nam usługi z zakresu obsługi prawnej.

8. Your rights in relation to the processing of personal data

You have the following rights in relation to the processing of your personal data:

1. prawo do wniesienia sprzeciwu wobec przetwarzania danych w celach marketingowych lub badania jakości i satysfakcji – jako że przetwarzamy Twoje dane na podstawie prawnie uzasadnionego interesu,
2. the right to object to the processing of your data on the grounds of a particular situation – in cases where we process your data on the basis of our legitimate interest for purposes other than those set out in point 1 above,

3. The right of access to your personal data,
4. The right to request the rectification of your personal data,
5. the right to request the erasure of your personal data, provided that we are not required by law to continue processing it,
6. The right to request the restriction of the processing of your personal data,
7. The right to portability of your personal data.

To exercise the above rights, please contact us or our Data Protection Officer (contact details in points 1 and 2 above).

Right to lodge a complaint with an authority

You also have the right to lodge a complaint with the supervisory authority in charge of personal data protection, i.e. the President of the Data Protection Authority.

Right to withdraw consent to the processing of personal data

If your data is processed on the basis of your consent, you have the right to withdraw that consent at any time without any adverse consequences. This does not affect the lawfulness of any processing carried out prior to the withdrawal of consent.

9. Transfer of data to third countries

In order to ensure the highest possible quality of our services, we use third-party providers, for example for IT support; as a result, personal data may be transferred outside the European Economic Area (hereinafter: EEA). We assure you that any transfer of data outside the EEA will be carried out on the basis of an appropriate agreement between us and the relevant entity, containing the standard contractual clauses adopted by the European Commission, or on the basis of a relevant decision by the European Commission. A copy of the standard contractual clauses referred to above may be obtained from the Data Protection Officer. Accordingly, you may request further information about the safeguards in place in this regard, obtain a copy of these safeguards, and find out where they are made available.

10 Obligation to provide data

Providing data:

• is a statutory requirement to the extent necessary for the provision of healthcare services and the maintenance of medical records,
• a condition for the conclusion and performance of a contract in the case of services provided for a fee,
• voluntary in respect of data processed on the basis of consent.

Failure to provide the required information may prevent us from providing healthcare or carrying out the service.